Pillsbury Winthrop Shaw Pittman LLP 

725 South Figueroa Street, Suite 2800 | Los Angeles, CA 90017-5406 | 


August 20, 2018 

Office of the Attorney General 
State of New Hampshire 
33 Capitol Street 
Concord, NH 03301 

RE: Notification of Data Security Breach Incident 

Dear Sir/Madam: 

This letter is being sent in accordance with state law to inform your office that information about 
4 New Hampshire residents may have been subject to unauthorized access through one of our 
client’s service providers. The information impacted was provided by our client Bank of the 
West to its service provider in connection with data analysis services relating to our business 
banking customers. The information included the business name (which could be an individual 
person’s name as a DBA) and a business taxpayer identification number (which could be an 
individual’s Social Security Number in the case of a sole proprietorship). The service provider 
advised the Bank that unauthorized third parties used compromised credentials to log into a 
limited number of their employee email accounts and may have accessed the information of the 
impacted New Hampshire residents. The Bank does not have information that the individual 
data has been misused but, in an abundance of caution, is notifying the affected individuals of the 
incident. We have enclosed a copy of the notice letter that we will be mailing to affected 
individuals on August 20,2018 pursuant to 15 U.S.C. §6801 - 6809 and the associated 
Interagency Guidance on Response Programs for Unauthorized Access to Customer Information 
and Customer Notice. 

The three Consumer Reporting Agencies have not been notified of this incident. Immediately 
upon receipt of notification of this incident from the service provider, the Bank confirmed that 
the service provider has engaged a cybersecurity forensics firm, notified federal law enforcement 
and taken steps to enhance their security protocols. The Bank is offering the affected individuals 
one year of Identity Guard®, a credit monitoring and identity theft protection service provided 
by Intersections Inc. (NASDAQ: INTX), a leading provider of consumer and corporate identity 
risk management services. 

Should you have any additional questions, you may contact me directly at (213) 488-7362. 

Sincerely, 

„ i *■ r N - 

Catherine D. Meyer 
Senior Counsel 


tel 213.488.7100 | fax 213.629.1033 

Catherine D. Meyer 
tel: 213.488.7362 
catherine.meyer@pillsbuiylaw.com 
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August 20, 2018 


Customer Name ls 0818-088 

Street Address 
City, State Zip 


Dear Customer Name, 

I am writing to notify you about an information security incident involving your business information. 

What Happened? 

On March 2, 2018, we were notified of a security incident that occurred at one of our contracted service 
providers who furnishes Bank of the West with business data analysis services relating to our business 
banking customers. The service provider's investigation determined that unauthorized third parties used 
compromised credentials to log into a limited number of their employee email accounts and may have 
accessed information associated with your business. On March 19,2018, we received a copy f the data 
file that may have been illegally accessed. We immediately took action, however, the data file was not in 
an easily useable format and required significant analysis to identify potentially affected individuals and 
associated mailing addresses. 

What information Was Involved? 

The data fie contained certain personal information provided to Bank of the West in a business context, 
including your business name (which may be an individual person's name) and a business identif cation 
number (which may be a Social Security number, such as in the case of a sole proprietorship). While the 
information is technically business-related and it is unknown if the fie in question was actually accessed 
and compromised, we are nevertheless providing notif cation to you about this unfortunate situation out of 
an abundance of caution given the potential inclusion of your personal name, along with your personal 
Social Security number in relation to the business. 

What We Are Doing? 

We take this matter very seriously and regret any inconvenience. Our investigation indicates that the 
responsible service provider took steps to enhance their security protocols, engaged a cybersecurity 
forensics f rm, and notified Federal law enforcement as soon as they identif ed the issue. As a result of 
this unfortunate situation. Bank of the West would like to offer you ayear of free credit monitoring and 
identity theft protection services as a courtesy. Please refer to the Other Important Information section 
of this letter for enrollment information. 

What You Can Do 

Bank of the West recommends closely reviewing all of your account statements for suspicious activity. If 
you find anything suspicious or fraudulent, you should call the Bank at the telephone number listed on 
your account statement. As a reminder, in general, if you become aware of unauthorized transactions on 
your account and promptly report those transactions to the Bank, you will not be responsible for 
unauthorized withdrawals, transfers, or purchases made using your debit card. 

You have the right to obtain a copy of your credit report for free once ayear from each credit reporting 
agency. You can obtain a free credit report by visiting www.annualcreditreport.com, by calling (877) 322- 
8228, or by completing the Annual Credit Request Form and mailing it to: Annual Credit Report Request 
Service, P.0. Box 105281 Atlanta, GA 30348-5281. We suggest you remain vigilant over the next 12 to 24 
months by checking your account statements monthly and requesting your free credit report from one 
bureau at a time every four months. If you have questions regarding the information appearing on your 
credit report, please call the credit agency at the telephone number on the credit report. 


Please see reverse for additional information 


If you do find suspicious activity on your credit report, call your local police or sheriffs office and file a 
report of identity theft. Get a copy of the police report, as you may need to give copies of the police report 
to creditors to clear up your records. It is also recommended that you report any incidents of identity 
theft to Bank of the West, as well as to the Federal Trade Commission (FTC). The FTC can be contacted 
toll-free at (877) 438-4338 (877-ID-THEFT). You can visit the FTC's website at: www.identitytheft.gov. 

In addition to reviewing your credit report, you have the right to place an initial "fraud alert" on your 
credit file. You can do this by calling any one of the three credit reporting agencies at the telephone 
numbers shown below. Doing so will let you automatically place fraud alerts with all three agencies, and 
you will be sent information on how you can order a free credit report from each of the agencies. The 
"fraud alert" will stay on your credit report for 90 days. After that you can renew the alert for additional 
90-day periods by calling any one of the three agencies: 


Equifax 

(888) 766-0008 
P.0. Box 740241 
Atlanta, GA 30374-0241 
www.equifax.com 


Experian 
(888) 397-3742 
P.O. Box 9532 
Allen, TX 75013 
www.experian.com 


TransUnion 
(800) 680-7289 
P.O. Box 2000 
Chester, PA 19016 
www.transunion.com 


If you want to learn more about the steps you can take to avoid identity theft, visit the Federal Trade 
Commission's website. The FTC runs the U.S. government's identity theft information website, at 
www.identitytheft.gov. You can also contact the FTC via telephone at (877) ID-THEFT (877-438-4338). The 
FTC and the consumer reporting agencies can also provide you with additional information about using 
fraud alerts and security freezes to protect your information. 

Other Important Information 

COMPLIMENTARY SERVICE OFFER 

Bank of the West is offering you a free one-year subscription to Identity Guard*, a credit monitoring and 
identity theft protection service. Identity Guard provides essential monitoring and protection of not only 
credit data, but also alerts you of certain activities that could indicate potential identity theft. This 
program is provided by Intersections Inc. (NASDAQ: INTX), a leading provider of consumer and corporate 
identity risk management services. 

Identity Guard* features include : 

• 3-Bureau Credit Report and Scores* 

• 3-Bureau Daily Monitoring with Notify Express* Alerts 

• 3-Bureau Quarterly Credit Update 

• Victim Assistance 

• Credit Education Specialists 

• Up to $20,000 identity theft insurance with $0 deductible** 

If you wish to take advantage of this monitoring service, you must enroll by October 20,2018. 


*The scores you receive with Identity Guard* are provided tor educational purposes to help you understand your credit. They 
are calculated using the information contained in your Equifax, Experian and TransUnion credit files. Lenders use many 
different credit scoring systems, and the scores you receive with Identity Guard are not the same scores used by lenders to 
evaluate your credit. 

Credit scores are provided by CreditXpert* based on data from the three major credit bureaus. 

**ldentity Theft Insurance underwritten by insurance company subsidiaries or affiliates of American 
International Group, Inc. The description herein is a summary and intended for informational purposes 
only and does not include all terms, conditions and exclusions of the policies described. Please refer to the 
actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all 
jurisdictions. 







0 IDENTITY 

fpP GUARD. 

www.identitvguard.com 

Identity Guard's Victim Recovery Services - one of the many product features available through an 
Identity Guard subscription. 

Customers who believe they are a victim of identity theft should contact the Identity Guard Customer 
Service Department at 1-800-452-2541. 

Customers will be assigned a specially trained Dedicated Case Manager for a minimum of 60 days and 
who acts as the customer's primary point of contact for any Victim Recovery Services activities. 

If ever a victim of Identity Theft, Victim Recovery Services Agent will work directly with the customer to: 

• Review the customer's 3-Bureau Credit Report and if discrepancies are found, the Victim 
Recovery Services Agent will help you to notify creditors via US mail. 

• Review the customer's account on a regular basis and if activity occurs, call the customer to 
confirm the activity is legitimate. 

• Assist customer in placing Fraud Alerts with the Credit Bureaus. 

• Assist customer with filing disputes with the Credit Bureaus. 

• Send the customer a summary letter that outlines certain activities that have been detected 
that may indicate fraud, a blank uniform Affidavit, contact information for all three Credit 
Bureaus, as well as a Fraud First Aid Kit. 

• Assist with contacting the Insurance Carrier to file a claim. 

• Discuss additional measures such as filing a police report. 


The information provided by Identity Guard is for informational purposes only and not for the purpose of 
providing legal advice. You should contact your attorney to obtain advice with respect to any particular 
issue or problem. 



